fix(live): accept monitor debug directories on Windows

packages/live-host/README.md

@@ -122,6 +122,9 @@ Capture Mode（On Demand／Live Feed）三个同级设置组，以及独立 daem
 `~/.qwen-live/config.json`，也支持 daemon 的 `QWEN_LIVE_DATA_DIR`）。保存后需重启
 Qwen Live 才应用手动修改。旧 daemon 或内置 `qwen serve` 不提供此入口能力；文件
 缺失、不是常规文件（包括符号链接）或编辑器打开失败时会提示，不自动创建或覆盖配置。
+运行时保存（语言、显示器与 Memory 偏好）通过独占临时文件加 rename 原子重写
+`config.json`，并在 macOS／Linux 上置为仅所有者可访问（`0600`）；Windows 没有
+POSIX 权限位，文件隔离性取决于数据目录自身的 ACL。
 设置标题栏可以拖动，与小球共享位置记忆；打开时先等待原生窗口完成屏内定位再显示，
 避免边缘处先露出被裁切的面板。用户说话的小音量视觉响应已增强，保留有界动画和缓慢
 回落，不会提高发送给模型的音频音量。
@@ -267,7 +270,13 @@ daemon 的 debug 模式另外为视觉 Monitor 保存真实请求，目录为系
 `proactive.monitor_debug_started` 和 `proactive.monitor_request_saved` 日志给出绝对路径。
 仅 daemon debug 开启；Host 的 `--live-debug` 单独启用不会录制，纯音频 Monitor 也不录制。
 启动及新建 Monitor 时清理，只保留最近创建的 10 个 Monitor（不是最近 10 次请求）。
-被清理的 Monitor 继续运行但停止录制；文件仅当前用户可访问。内容包含真实屏幕／摄像头、
+删除尽力而为：无法移除的归档（例如 Windows 上被其他进程占用文件）会超出该上限
+保留，上报 `proactive.monitor_debug_prune_failed` 并附带失败原因，之后的清理
+会重试直至可以移除；`EACCES` 等来自删除本身的持续性原因需要手动清理。
+未通过归属校验的归档会被静默跳过、不予上报，也不计入该上限，需人工查找并清理。
+被清理的 Monitor 继续运行但停止录制。文件仅在 macOS／Linux 上保证仅当前用户可访问
+（0700/0600 强制执行，不满足则拒绝）；Windows 无法校验 POSIX 权限位，
+隔离性仅取决于系统临时目录自身继承的 ACL。内容包含真实屏幕／摄像头、
 任务文本和混合 Monitor 的麦克风输入，虽然不保存连接凭据，画面或音频中的秘密不会被脱敏。
 录制失败会单独报错而不影响通话；长时间 debug 可能占用较多磁盘，诊断完请关闭 debug。
 完整格式与清理规则见 [Qwen Live README](../qwen-live/README.md)。

packages/qwen-live/README.md

@@ -224,6 +224,10 @@ capability-negotiated; older Hosts/daemons keep their existing behavior.
 
 Configuration comes from `~/.qwen-live/config.json` (generated by `init`),
 with environment variables (`DASHSCOPE_API_KEY`, `QWEN_LIVE_*`) as overrides.
+Runtime saves (language, display and memory preferences) rewrite `config.json`
+atomically through an exclusive temporary file plus rename and mark it
+owner-only (`0600`) on macOS/Linux; Windows has no POSIX permission bits, so
+there the file's isolation depends on the data directory's own ACLs.
 
 ```jsonc
 {
@@ -401,11 +405,22 @@ history. Queued/dropped frames are not presented as sent frames.
 These are **sensitive recordings of real screen/camera content, task prompts and,
 for audio/visual Monitors, microphone audio**. Connection credentials are omitted;
 visible or spoken secrets inside media are not redacted. Directories/files are
-owner-only. Debug startup and new Monitor creation keep only the ten most
-recently created Monitor directories; this is not a ten-request or disk-size
-limit. An evicted Monitor keeps running but stops recording and logs skipped
-requests. Disk/permission failures or exceeding the 32 MiB pending-write budget
-disable that recorder and log an incomplete recording without stopping the call.
+**owner-only on macOS and Linux** (enforced 0700/0600 and rejected otherwise);
+on Windows the store cannot check POSIX modes, so isolation is only whatever
+ACLs the OS temporary directory inherits. Debug startup and new Monitor
+creation keep only the ten most recently created Monitor directories; this is
+not a ten-request or disk-size limit. Deletion is best-effort: an archive
+that cannot be removed (for example a file held open by another process on
+Windows) is kept past this cap and reported as
+`proactive.monitor_debug_prune_failed` with the failure reason, and later
+prunes retry it until it can be removed; a persistent reason such as `EACCES`
+from the deletion itself needs manual cleanup. An archive that fails the
+ownership scan is skipped silently rather than reported, is not counted
+against this cap, and must be found and removed by hand. An evicted Monitor
+keeps running
+but stops recording and logs skipped requests. Disk/permission failures or
+exceeding the 32 MiB pending-write budget disable that recorder and log an
+incomplete recording without stopping the call.
 Long-running debug Monitors can consume significant disk space; disable debug
 after diagnosis and do not share recordings without reviewing their contents.
 

packages/qwen-live/src/language-preferences.test.ts

@@ -64,11 +64,22 @@ describe('Live language preference', () => {
       ...raw,
       language: 'zh-CN',
     });
-    if (process.platform !== 'win32')
-      expect(statSync(path).mode & 0o777).toBe(0o600);
     expect(readdirSync(dataDir)).toEqual(['config.json']);
   });
 
+  // Windows has no POSIX permission bits, so skip (reportedly) rather than
+  // passing a test that asserted nothing.
+  it.skipIf(process.platform === 'win32')(
+    'writes the language config with 0600 permissions',
+    () => {
+      const dataDir = directory();
+      const path = join(dataDir, 'config.json');
+      writeFileSync(path, '{"realtimeApiKey":"fixture-key"}');
+      persistLanguagePreference(dataDir, 'zh-CN');
+      expect(statSync(path).mode & 0o777).toBe(0o600);
+    },
+  );
+
   it('rejects invalid language before writing and preserves config on atomic rename failure', () => {
     const dataDir = directory();
     const path = join(dataDir, 'config.json');

packages/qwen-live/src/memory/service.test.ts

@@ -129,9 +129,6 @@ describe('persistMemoryPreferences', () => {
       retrieve: { useVector: false },
     });
     expect(resolved.updater.model).toBe('custom-memory-model');
-    if (process.platform !== 'win32') {
-      expect(statSync(configPath).mode & 0o777).toBe(0o600);
-    }
     expect(readdirSync(dataDir)).toEqual(['config.json']);
   });
 
@@ -177,12 +174,24 @@ describe('persistMemoryPreferences', () => {
     });
     expect(saved.memory.observer).not.toHaveProperty('model');
     expect(resolved.observer.model).toBe('custom-memory-model');
-    if (process.platform !== 'win32') {
-      expect(statSync(configPath).mode & 0o777).toBe(0o600);
-    }
     expect(readdirSync(dataDir)).toEqual(['config.json']);
   });
 
+  // Windows has no POSIX permission bits, so skip (reportedly) rather than
+  // passing a test that asserted nothing.
+  it.skipIf(process.platform === 'win32')(
+    'writes the memory config with 0600 permissions',
+    () => {
+      const plain = fixture();
+      persistMemoryPreferences(plain.dataDir, { enabled: false });
+      expect(statSync(plain.configPath).mode & 0o777).toBe(0o600);
+      const bom = fixture();
+      writeFileSync(bom.configPath, `\uFEFF${JSON.stringify(bom.raw)}`);
+      persistMemoryPreferences(bom.dataDir, { enabled: false });
+      expect(statSync(bom.configPath).mode & 0o777).toBe(0o600);
+    },
+  );
+
   it('leaves the original file untouched and cleans its temporary file when replacement fails', () => {
     const { dataDir, configPath } = fixture();
     const before = readFileSync(configPath, 'utf8');

packages/qwen-live/src/proactive/monitor-debug-store.test.ts

@@ -26,6 +26,58 @@ import {
   type MonitorDebugRecorder,
 } from './monitor-debug-store.js';
 
+const rmFailures = vi.hoisted(() => new Map<string, number>());
+const rmCalls = vi.hoisted(
+  () => [] as Array<{ path: string; options: unknown }>,
+);
+// One-shot lstat tampering after `after` real calls, simulating a concurrent
+// pruner or tamperer acting between the prune scan and the deletion phase.
+const lstatTampers = vi.hoisted(
+  () => new Map<string, { after: number; effect: 'enoent' | 'symlink' }>(),
+);
+
+vi.mock('node:fs/promises', async (original) => {
+  const fs = await original<typeof import('node:fs/promises')>();
+  return {
+    ...fs,
+    lstat: async (
+      path: Parameters<typeof fs.lstat>[0],
+      options?: Parameters<typeof fs.lstat>[1],
+    ) => {
+      const key = String(path);
+      const tamper = lstatTampers.get(key);
+      if (tamper) {
+        if (tamper.after > 0) {
+          tamper.after -= 1;
+        } else {
+          lstatTampers.delete(key);
+          if (tamper.effect === 'symlink') {
+            const stat = await fs.lstat(path);
+            stat.isSymbolicLink = () => true;
+            return stat;
+          }
+          throw Object.assign(new Error('no such file or directory'), {
+            code: 'ENOENT',
+          });
+        }
+      }
+      return fs.lstat(path, options);
+    },
+    rm: async (
+      path: Parameters<typeof fs.rm>[0],
+      options?: Parameters<typeof fs.rm>[1],
+    ) => {
+      rmCalls.push({ path: String(path), options });
+      const remaining = rmFailures.get(String(path));
+      if (remaining) {
+        rmFailures.set(String(path), remaining - 1);
+        throw Object.assign(new Error('busy'), { code: 'EBUSY' });
+      }
+      return fs.rm(path, options);
+    },
+  };
+});
+
 const INFO: MonitorDebugInfo = {
   taskId: 'monitor-1',
   taskGeneration: 3,
@@ -78,6 +130,9 @@ describe('MonitorDebugStore', () => {
   afterEach(async () => {
     await Promise.all(stores.map((item) => item.flush()));
     vi.restoreAllMocks();
+    rmFailures.clear();
+    rmCalls.length = 0;
+    lstatTampers.clear();
     await rm(temporary, { recursive: true, force: true });
   });
 
@@ -225,7 +280,31 @@ describe('MonitorDebugStore', () => {
       text: 'Reply [redacted]',
       result: 'reply',
     });
-    if (process.platform !== 'win32') {
+    expect(log).toHaveBeenCalledWith(
+      'proactive.monitor_request_saved',
+      expect.objectContaining({
+        directory: archive.directory,
+        requestDirectory: directory,
+        imageFrames: 2,
+        audioBytes: audio.length + silence.length,
+      }),
+    );
+  });
+
+  // Windows has no POSIX permission bits, so skip (reportedly) rather than
+  // passing a test that asserted nothing.
+  it.skipIf(process.platform === 'win32')(
+    'archives monitor recordings with private permissions',
+    async () => {
+      const archive = await recorder();
+      sendImage(archive, Buffer.from([0xff, 0xd8, 1, 2, 0xff, 0xd9]));
+      sendImage(archive, Buffer.from([0xff, 0xd8, 3, 4, 0xff, 0xd9]));
+      sendAudio(archive, Buffer.from([0, 0, 0xff, 0x7f, 0, 0x80]));
+      commit(archive);
+      archive.result({ status: 'completed', text: 'reply' });
+      await store.flush();
+
+      const directory = join(archive.directory, 'requests', '000001');
       for (const path of [
         root,
         archive.directory,
@@ -246,17 +325,8 @@ describe('MonitorDebugStore', () => {
       ]) {
         expect((await lstat(path)).mode & 0o777).toBe(0o600);
       }
-    }
-    expect(log).toHaveBeenCalledWith(
-      'proactive.monitor_request_saved',
-      expect.objectContaining({
-        directory: archive.directory,
-        requestDirectory: directory,
-        imageFrames: 2,
-        audioBytes: audio.length + silence.length,
-      }),
-    );
-  });
+    },
+  );
 
   it('separates requests and transports without copying old media or cleared inputs', async () => {
     const archive = await recorder();
@@ -406,9 +476,106 @@ describe('MonitorDebugStore', () => {
     });
   });
 
+  it('keeps pruning and recording when one stale archive cannot be deleted', async () => {
+    await mkdir(root, { mode: 0o700 });
+    const owned: string[] = [];
+    for (let time = 1; time <= 12; time += 1)
+      owned.push(await ownedDirectory(time));
+    // The prune visits stale archives newest-first, so blocking owned[1]
+    // leaves the older owned[0] to prove the loop continued. Block the media
+    // subtree, as a held-open media file does: the removal must fail before
+    // the marker is touched, so the next prune still recognizes the archive.
+    rmFailures.set(join(owned[1]!, 'requests'), 1);
+    expect(await store.initialize()).toBe(true);
+    await expect(lstat(owned[0]!)).rejects.toMatchObject({ code: 'ENOENT' });
+    expect((await lstat(owned[1]!)).isDirectory()).toBe(true);
+    expect((await lstat(join(owned[1]!, 'monitor.json'))).isFile()).toBe(true);
+    expect(log).toHaveBeenCalledWith(
+      'proactive.monitor_debug_prune_failed',
+      expect.objectContaining({
+        directory: owned[1],
+        retained: true,
+        reason: 'EBUSY',
+      }),
+    );
+    // A retained archive must never be logged as destroyed.
+    expect(log).not.toHaveBeenCalledWith(
+      'proactive.monitor_debug_pruned',
+      expect.objectContaining({ directory: owned[1] }),
+    );
+    // Once the handle clears, the next prune retries and removes the archive.
+    expect(await store.initialize()).toBe(true);
+    await expect(lstat(owned[1]!)).rejects.toMatchObject({ code: 'ENOENT' });
+    expect(log).toHaveBeenCalledWith('proactive.monitor_debug_pruned', {
+      directory: owned[1],
+    });
+    // maxRetries rides out a transient handle (AV scanner/indexer) on Windows;
+    // the budget must ride on both removals, not just the media subtree.
+    for (const path of [join(owned[1]!, 'requests'), owned[1]!])
+      expect(rmCalls.find((call) => call.path === path)?.options).toEqual(
+        expect.objectContaining({
+          recursive: true,
+          force: true,
+          maxRetries: 3,
+        }),
+      );
+    const recorder = store.create(INFO);
+    expect(recorder).toBeDefined();
+    await recorder!.start();
+    expect(log).not.toHaveBeenCalledWith(
+      'proactive.monitor_debug_failed',
+      expect.objectContaining({ reason: 'initialization_failed' }),
+    );
+  });
+
+  it('reports nothing when a concurrent pruner removes a stale archive first', async () => {
+    await mkdir(root, { mode: 0o700 });
+    const owned: string[] = [];
+    for (let time = 1; time <= 12; time += 1)
+      owned.push(await ownedDirectory(time));
+    // The scan recognizes owned[1]; a second store on the same root then
+    // removes it before this prune's deletion phase. Nothing was retained,
+    // so neither a failure nor a pruned event may be logged for it.
+    lstatTampers.set(owned[1]!, { after: 1, effect: 'enoent' });
+    expect(await store.initialize()).toBe(true);
+    await expect(lstat(owned[0]!)).rejects.toMatchObject({ code: 'ENOENT' });
+    expect((await lstat(owned[1]!)).isDirectory()).toBe(true);
+    expect(log).not.toHaveBeenCalledWith(
+      'proactive.monitor_debug_prune_failed',
+      expect.objectContaining({ directory: owned[1] }),
+    );
+    expect(log).not.toHaveBeenCalledWith(
+      'proactive.monitor_debug_pruned',
+      expect.objectContaining({ directory: owned[1] }),
+    );
+  });
+
+  it('reports the reason when a stale archive turns unsafe mid-prune', async () => {
+    await mkdir(root, { mode: 0o700 });
+    const owned: string[] = [];
+    for (let time = 1; time <= 11; time += 1)
+      owned.push(await ownedDirectory(time));
+    // The scan accepts owned[0], then the archive is swapped for a symlink
+    // before the deletion phase rechecks it. The refusal is a privacy guard,
+    // not a transient OS delete failure, and must be reported by name.
+    lstatTampers.set(owned[0]!, { after: 1, effect: 'symlink' });
+    expect(await store.initialize()).toBe(true);
+    expect((await lstat(owned[0]!)).isDirectory()).toBe(true);
+    expect(log).toHaveBeenCalledWith(
+      'proactive.monitor_debug_prune_failed',
+      expect.objectContaining({
+        directory: owned[0],
+        retained: true,
+        reason: 'unsafe_directory',
+      }),
+    );
+  });
+
   it('rejects shared or symlink archive roots without touching their contents', async () => {
     await mkdir(root, { mode: 0o700 });
     await writeFile(join(root, 'keep.txt'), 'keep');
+    // Windows has no POSIX permission bits; a shared-looking mode cannot be
+    // expressed or rejected there.
     if (process.platform !== 'win32') {
       await chmod(root, 0o755);
       expect(await store.initialize()).toBe(false);
@@ -424,6 +591,25 @@ describe('MonitorDebugStore', () => {
     expect(await readFile(join(root, 'keep.txt'), 'utf8')).toBe('keep');
   });
 
+  it('accepts directories on Windows, where POSIX permission bits do not exist', async () => {
+    vi.spyOn(process, 'platform', 'get').mockReturnValue('win32');
+    // Both READMEs' Windows isolation caveat assumes the default root stays
+    // inside the OS temporary directory.
+    expect(new MonitorDebugStore(log).root).toBe(
+      join(tmpdir(), 'qwen-live-monitor-debug'),
+    );
+    await mkdir(root, { mode: 0o700 });
+    // Stand-in for Windows reporting every directory with group/other bits.
+    await chmod(root, 0o755);
+    expect(await store.initialize()).toBe(true);
+
+    // Symlink rejection is not platform-gated and must still apply.
+    const linked = new MonitorDebugStore(log, join(temporary, 'linked-win32'));
+    stores.push(linked);
+    await symlink(root, linked.root);
+    expect(await linked.initialize()).toBe(false);
+  });
+
   it('does not recreate an active directory pruned by another store', async () => {
     const archive = await recorder();
     const otherStore = new MonitorDebugStore(log, root);